POSTGRESQL · CVE-2026-116323 · Runtime
NO FIX YET · SEE WHAT TO DO
PostgreSQL's pltcl procedural language has a use-after-free bug triggered when a domain CHECK constraint re-enters the Tcl interpreter. A user who can create database objects can use it to execute arbitrary code as the operating system user running the database.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Only PostgreSQL servers with the pltcl language installed are exposed, since the flaw is in its Tcl interpreter integration. The attacker must be able to create objects such as domains with CHECK constraints, so databases where only trusted administrators can create objects carry lower risk. Servers without pltcl can skip it.
Not affected if no-untrusted-object-creators, pltcl-not-installed
Who cares database, postgresql, self-hosted
psql -c "SHOW server_version;" and compare against the fixed versions below.psql -c "SELECT * FROM pg_extension WHERE extname = 'pltcl';".pltcl language is available: psql -c "SELECT lanname FROM pg_language WHERE lanname = 'pltcl';".18.7, 17.12, , , and contain the fix; earlier versions in each line are affected.Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
16.1615.2014.25